I tried deleting and recreating the token several times, but it ends up getting expired even though the Expires: was left empty (in other words "never" expire).

I am also the admin of the account and generate tokens by using "+ New Access Token" under "Approved Integration" of the https://our.server.edu/profile/settings page, there are some old tokens used by LTI integrations, and they don't have any issues. It appears after calling SIS import API the token somehow gets marked for expiration.

We are not using the cloud version, but the self-hosted version checked out from GitHub - instructure/canvas-lms at prod